Docs Hub VaagaTech Main
Overview Architecture Payment Gateway Security & Hardening Docs Hub VaagaTech Main →
Financial Engineering & Reconciliation

Payment Gateway & Automated Refunds

Double-verification payment flow using Paytm Payment Gateway with HMAC checksum validation, idempotent webhook ingestion, and real-time automated stock reversal on cancellations.

Double-Verification Workflow

Client-side checkout responses are never trusted. Every transaction must pass server-to-server checksum validation and explicit status query check.

[Customer Browser]               [Vastra API Lambda]              [Paytm API Gateway]
        |                                 |                                 |
        |---- 1. POST /api/checkout ----->|                                 |
        |                                 |---- 2. Initiate Transaction --->|
        |                                 |<--- 3. Return txnToken ---------|
        |<--- 4. Render Paytm Checkout ---|                                 |
        |                                 |                                 |
        |=== Customer Pays via UPI/Card ===================================|
        |                                 |                                 |
        |---- 5. Browser Callback -------->|                                 |
        |                                 |---- 6. Query Payment Status --->|
        |                                 |<--- 7. Verified Status (01) ----|
        |                                 |                                 |
        |                                 |<=== 8. Async Webhook (HMAC) ====;
        |                                 |     (Idempotent Reconciliation) |
        |                                 |                                 |
        |<--- 9. Order Confirmed Screen --|                                 |

Idempotent Webhook Processing

Webhooks may arrive out-of-order or duplicate due to network retries. Vastra Platform guarantees idempotency using transactional conditional writes.

Condition Paytm Response Code System Action Inventory Outcome
Txn Success RESPCODE: "01" Order status → CONFIRMED, trigger email invoice Inventory reservation finalized
Txn Failure / Timeout RESPCODE: "141" / "227" Order status → PAYMENT_FAILED Inventory reservation lock immediately released
Merchant Cancel Admin Desk Action Lambda calls Paytm Refund API with refundId Stock units incremented back atomically
Duplicate Webhook Any Ignored if order already transitioned to terminal status No side-effects

Environment Configuration

Credentials stored securely in AWS Secrets Manager or GitHub Actions Repository Secrets.

# Staging Environment
PAYTM_MID="STAGE_MID_XXXXX"
PAYTM_MERCHANT_KEY="STAGE_KEY_XXXXX"
PAYTM_WEBSITE="WEBSTAGING"
PAYTM_ENV="staging"
PAYTM_CALLBACK_URL="https://dev-api.stylewithvikashini.com/api/payment/callback"

# Production Environment
PAYTM_MID="PROD_MID_XXXXX"
PAYTM_MERCHANT_KEY="PROD_KEY_XXXXX"
PAYTM_WEBSITE="DEFAULT"
PAYTM_ENV="production"
PAYTM_CALLBACK_URL="https://api.stylewithvikashini.com/api/payment/callback"